[962] in winnt
Re: Fwd: Re: Questionable Pop UP
daemon@ATHENA.MIT.EDU (Kerem B Limon)
Wed Oct 16 11:54:25 2002
Message-Id: <5.1.1.6.2.20021016113102.05243638@po11.mit.edu>
Date: Wed, 16 Oct 2002 11:53:55 -0400
To: Allen Moulton <amoulton@mit.edu>
From: Kerem B Limon <kerem.limon@MIT.EDU>
Cc: ntpartners@mit.edu
In-Reply-To: <4.3.2.7.2.20021016100107.03f54340@po10.mit.edu>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"; format=flowed
This is not an official recommendation, but just to address those of you
who want to know the answer; I'd urge you to wait for the official Stock
Answer to be published before publicizing it widely to your users or
implementing it on a critical system.
You can disable the Messenger service under Administrative Tools on NT 4
(Start Menu), 2000, and XP (Control Panel), Services item. Currently, with
the exception of the VirusScan alerter, no other service depends on
Messenger on my NT 4, 2000, XP machines. To disable it, you can either
simply select Disable or set the Startup type to Manual if you think you'd
want to turn it on at some point later on. Again, you'd want to check
dependencies on your system before you do this. Here, again, is the excerpt
about what we know to have dependencies on Messenger service:
>We have now identified 3 types of software that use the NetBIOS Messenger
>service for legitimate purposes. These are:
>
>- some "desktop" UPS units use the Messenger service to notify users when
>there has been a power failure and the computer is using the UPS. More
>expensive UPS units do not use this service for notification. (identified by
>MIT)
>
>- some older printers send notifications about paper jams, empty paper bins,
>and low toner, via the Messenger service. Newer printers tend to use SNMP or
>other mechanism for this notification. (identified by Microsoft)
>
>- the VirusScan alter service (identified by Kerem)
Kerem
At 2002-10-16 10:06 Wednesday, Allen Moulton wrote:
>I have the same WEBPOPUPxx but xx is a different number.
>
>It appears at logon to Win2000.
>
>I can see the process in Task Manager, but do not know how to figure out
>what program initiated or is running in the process.
>
>Allen Moulton
>MIT Sloan School of Management
>
>>Date: Wed, 16 Oct 2002 08:34:47 -0400
>>From: Mike Hobbs <mhobbs@rowsdower.net>
>>To: Barbara Santorella <bsantore@MIT.EDU>
>>CC: ntpartners@MIT.EDU
>>Subject: Re: Questionable Pop UP
>>
>>I am getting this as well.
>>
>>Barbara Santorella wrote:
>> >
>> > Hello all,
>> >
>> > I have had a questionable pop up appear on several of my computers. A
>> > window pops up on the screen that appears from Windows "Messenger
>> > Service" it states that the message is from WEBPOPUP06 and is addressed
>> > to the actual computer name. It then goes on encouraging the recipient
>> > to call a phone number to purchase a diploma. Has anyone seen this?
>> > Do
>> > I need to be concerned from a security standpoint? I have a .jpg of
>> > the
>> > message, if anyone is inerested. I did not want to send an attachment
>> > to the whole list.
>> >
>> > Barbara Santorella
>> > Windows Administrator
>> > MIT Bates
>
